@skaile/workspaces 0.38.0 → 0.40.0

package/dist/library/index.js

@@ -1,8 +1,8 @@
-export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, TarballHashMismatchError, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, skaileHomeDir, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing } from '../chunk-UAYAK7N4.js';
-import '../chunk-O4PANZI2.js';
+export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KNOWN_ASSET_KINDS, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LIBRARY_STRUCTURES, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, TarballHashMismatchError, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, classifyRef, createEmptyLockFile, deriveSlug, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, interpolate, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, queryInstancePickerChoices, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolveLibraryDir, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, sha256Hex, skaileHomeDir, storeSecrets, trpcGetUrl, userConfigPath, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeManifestIfMissing } from '../chunk-O66LT7UI.js';
+import '../chunk-XNMABEHH.js';
 export { installFromManifest } from '../chunk-KYC6JH75.js';
 export { GITHUB_PAT_ENV, fetchAssetFilesFromGitHub } from '../chunk-R7FOF242.js';
-import '../chunk-ZDKJHQY2.js';
+import '../chunk-JXT46QFC.js';
 import '../chunk-FBIQ4QPF.js';
 import '../chunk-CFCSDZYF.js';
 import '../chunk-HL66R2P2.js';

package/dist/library/src/remote/remote-catalog-source.d.ts

@@ -33,7 +33,7 @@
  *
  * @docLink packages/library/api-reference#remote-catalog-source
  */
-import type { CatalogAsset, CatalogAssetFilter, CatalogSourceInfo, ICatalogSource } from "@skaile/workspaces/plugins";
+import type { CatalogAsset, CatalogAssetFilter, CatalogDomain, CatalogDomainFilter, CatalogSourceInfo, ICatalogSource } from "@skaile/workspaces/plugins";
 import type { InstallManifest } from "@skaile/workspaces/types";
 import { CatalogCache } from "./cache.js";
 /**
@@ -164,6 +164,16 @@ export declare class RemoteCatalogSource implements ICatalogSource {
      * is single-Source per spec; multi-source federation is Phase 4.8.
      */
     listSources(): Promise<CatalogSourceInfo[]>;
+    /**
+     * List navigational domains via `GET /trpc/catalog.listDomains`. Display-only,
+     * so this **never throws**: a missing endpoint (older store → 404), a transport
+     * error, or a malformed payload all degrade to `[]` rather than jeopardize the
+     * asset feed this call accompanies. Air-gapped mode returns `[]` (domains are
+     * not part of the offline cache in v1).
+     *
+     * Not cached — domains are read once per `skaile manage` open and are cheap.
+     */
+    listDomains(filter?: CatalogDomainFilter): Promise<CatalogDomain[]>;
     /**
      * Force a metadata-cache refresh. Wipes all resolve/list entries and
      * re-fetches `listAssets()` (no filter) to pre-warm the canonical query.

package/dist/library/src/remote/remote-catalog-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-catalog-source.d.ts","sourceRoot":"","sources":["../../../../library/src/remote/remote-catalog-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAuC,MAAM,YAAY,CAAC;AAM/E;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;CAC1C,KACE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,oGAAoG;IACpG,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAKjC;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAGvB,MAAM,EAAE,MAAM;aACd,GAAG,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,YAAA;CAK/B;AAQD;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IACjD,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,0BAA0B;IAiB5C;;;;;;;OAOG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAoBxD;;;;;;;OAOG;IACG,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBtE;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkCrE;;;;;OAKG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBlD;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAMjD;;;;;;;;;OASG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAYlD;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAwB/D;;;;;;;;;;;;;OAaG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAiCzE;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQxC,OAAO,CAAC,kBAAkB;YAkBZ,oBAAoB;YAMpB,iBAAiB;IAM/B,gEAAgE;YAClD,mBAAmB;IAkBjC,iEAAiE;YACnD,gBAAgB;CAwB/B;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrF"}
+{"version":3,"file":"remote-catalog-source.d.ts","sourceRoot":"","sources":["../../../../library/src/remote/remote-catalog-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EAEjB,cAAc,EACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAuC,MAAM,YAAY,CAAC;AAM/E;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;CAC1C,KACE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,oGAAoG;IACpG,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAKjC;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAGvB,MAAM,EAAE,MAAM;aACd,GAAG,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,YAAA;CAK/B;AAQD;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IACjD,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAEjD,IAAI,EAAE,0BAA0B;IAiB5C;;;;;;;OAOG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAoBxD;;;;;;;OAOG;IACG,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoBtE;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkCrE;;;;;OAKG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBlD;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIjD;;;;;;;;OAQG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAoBzE;;;;;;;;;OASG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAYlD;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAwB/D;;;;;;;;;;;;;OAaG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAiCzE;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQxC,OAAO,CAAC,kBAAkB;YAkBZ,oBAAoB;YAMpB,iBAAiB;IAM/B,gEAAgE;YAClD,mBAAmB;IAkBjC,iEAAiE;YACnD,gBAAgB;CAwB/B;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrF"}

package/dist/{open-library-WTN7QLN7.js → open-library-5KJOZHG7.js}

@@ -1,10 +1,10 @@
-export { openCatalogSource, openLibrary, openLibraryManager, resolveCatalogSource } from './chunk-6KKNROBU.js';
+export { openCatalogSource, openLibrary, openLibraryManager, resolveCatalogSource } from './chunk-XZNPKJXU.js';
 import './chunk-GYPA2Q7F.js';
-import './chunk-UAYAK7N4.js';
-import './chunk-O4PANZI2.js';
+import './chunk-O66LT7UI.js';
+import './chunk-XNMABEHH.js';
 import './chunk-KYC6JH75.js';
 import './chunk-R7FOF242.js';
-import './chunk-ZDKJHQY2.js';
+import './chunk-JXT46QFC.js';
 import './chunk-X46FY45B.js';
 import './chunk-FBIQ4QPF.js';
 import './chunk-CFCSDZYF.js';
@@ -19,5 +19,5 @@ import './chunk-ZAP2BDHG.js';
 import './chunk-JB35MVBN.js';
 import './chunk-HRKB2ATT.js';
 import './chunk-NSBPE2FW.js';
-//# sourceMappingURL=open-library-WTN7QLN7.js.map
-//# sourceMappingURL=open-library-WTN7QLN7.js.map
+//# sourceMappingURL=open-library-5KJOZHG7.js.map
+//# sourceMappingURL=open-library-5KJOZHG7.js.map

package/dist/{open-library-WTN7QLN7.js.map → open-library-5KJOZHG7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"open-library-WTN7QLN7.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"open-library-5KJOZHG7.js"}

package/dist/plugins/index.js

@@ -1,4 +1,4 @@
-export { AssetKindConflictError, AssetKindPathAmbiguityError, AssetKindPatternConflictError, AssetKindRegistryFrozenError, ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError, VERSION } from '../chunk-ZDKJHQY2.js';
+export { AssetKindConflictError, AssetKindPathAmbiguityError, AssetKindPatternConflictError, AssetKindRegistryFrozenError, ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError, VERSION } from '../chunk-JXT46QFC.js';
 import '../chunk-NSBPE2FW.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/plugins/src/catalog-source.d.ts

@@ -53,6 +53,47 @@ export interface CatalogAssetFilter {
     /** Prefix match on the full `<publisher>/<name>` ref. */
     prefix?: string;
 }
+/**
+ * How the members of a navigational domain relate. Display-only hint — never an
+ * install-all bundle. Mirrors the discovery library's `DomainRelation`.
+ */
+export type DomainRelation = "additions" | "alternatives" | "sequence";
+/**
+ * Display-only metadata for a navigational domain (from a sidecar `DOMAIN.md`,
+ * surfaced by the store's `catalog.listDomains`). Joined to assets via
+ * {@link CatalogAsset.domainSlug}. A domain groups assets for co-discovery; it
+ * is never part of asset identity and never bulk-installs.
+ *
+ * Defined inline (structurally compatible with `core`'s `CatalogDomain`) to keep
+ * `plugins` a zero-dependency leaf package.
+ */
+export interface CatalogDomain {
+    /** Stable slug — the join key to {@link CatalogAsset.domainSlug}. */
+    slug: string;
+    /** Human-readable title (may change without breaking the slug join). */
+    title: string;
+    /** Free-text description from the `DOMAIN.md` body. */
+    description?: string;
+    /** How members relate — drives sort + per-asset glyph, not installs. */
+    relation?: DomainRelation;
+    /** Display order among a publisher's domains (ascending). */
+    order?: number;
+    /** `kind:name` ref of the recommended member (alternatives domains). */
+    recommendedRef?: string;
+    /** Sidecar provenance — `"<org>/<repo>"` the `DOMAIN.md` was authored in. */
+    sidecarSource?: string;
+}
+/**
+ * Optional filter passed to {@link ICatalogSource.listDomains}.
+ *
+ * @docLink packages/workspace-plugin/index#plugin-interfaces
+ */
+export interface CatalogDomainFilter {
+    /** Restrict to domains whose Source has a published asset under this publisher. */
+    publisher?: string;
+    /** Restrict to a single Source id. */
+    source?: string;
+}
 /**
  * Descriptor returned by {@link ICatalogSource.listSources}.
  *
@@ -106,5 +147,16 @@ export interface ICatalogSource {
     fetchTarball(ref: string, sha256: string): Promise<Uint8Array>;
     /** List registered sources. */
     listSources(): Promise<CatalogSourceInfo[]>;
+    /**
+     * List navigational domains (display-only groupings from sidecar `DOMAIN.md`),
+     * optionally narrowed by publisher and/or source id.
+     *
+     * **Optional** — sources that don't model domains (local libraries, older
+     * stores, REST framings without the endpoint) omit it; consumers treat its
+     * absence (or `[]`) identically as "no domains". Display-only, so an
+     * implementation should degrade to `[]` on transport error rather than throw,
+     * to never jeopardize the asset feed it accompanies.
+     */
+    listDomains?(filter?: CatalogDomainFilter): Promise<CatalogDomain[]>;
 }
 //# sourceMappingURL=catalog-source.d.ts.map

package/dist/plugins/src/catalog-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-source.d.ts","sourceRoot":"","sources":["../../../plugins/src/catalog-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEnD,+CAA+C;IAC/C,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/D,+BAA+B;IAC/B,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CAC7C"}
+{"version":3,"file":"catalog-source.d.ts","sourceRoot":"","sources":["../../../plugins/src/catalog-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEnD,+CAA+C;IAC/C,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/D,+BAA+B;IAC/B,WAAW,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAE5C;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CACtE"}

package/dist/plugins/src/index.d.ts

@@ -2,7 +2,7 @@ export declare const VERSION = "0.0.0";
 export type { AssetKindFileFilter, AssetKindRequiresEdge, IAssetKindProvider, } from "./asset-kind-provider.js";
 export type { IAssetKindRegistry } from "./asset-kind-registry.js";
 export { AssetKindConflictError, AssetKindPathAmbiguityError, AssetKindPatternConflictError, AssetKindRegistryFrozenError, } from "./asset-kind-registry.js";
-export type { CatalogAsset, CatalogAssetFilter, CatalogSourceInfo, ICatalogSource, } from "./catalog-source.js";
+export type { CatalogAsset, CatalogAssetFilter, CatalogDomain, CatalogDomainFilter, CatalogSourceInfo, DomainRelation, ICatalogSource, } from "./catalog-source.js";
 export type { ISecretsProvider, ListFilter, ProviderCapabilities, SecretMetadata, SetSecretOptions, } from "./secrets-provider.js";
 export { ProviderUnavailableError, SecretAccessDeniedError, SecretExpiredError, SecretNotFoundError, SecretsError, } from "./secrets-provider.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/plugins/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../plugins/src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACb,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../plugins/src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACb,MAAM,uBAAuB,CAAC"}

package/dist/runner/index.js

@@ -1,5 +1,5 @@
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile } from '../chunk-OW32SQU3.js';
-import '../chunk-GL3MUJ5L.js';
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, stripStaleHtmlTail, touchSession, writeClaudeCodeCredentialsFile } from '../chunk-RM2KAMGD.js';
+import '../chunk-22Q5R7SM.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -14,10 +14,10 @@ import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
 import '../chunk-KM6DCR7A.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-DQLRTCA2.js';
+import '../chunk-3P7HBSSD.js';
 import '../chunk-OVRSNIKJ.js';
 import '../chunk-WLWHOA3S.js';
-import '../chunk-P7CIT445.js';
+import '../chunk-C5UK3JK7.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-X46FY45B.js';
 import '../chunk-DEYYRFQU.js';

package/dist/runner/src/ai-credential-refresh.d.ts

@@ -1,20 +1,10 @@
 /**
- * Proactive AI-credential refresh scheduler.
- *
- * Holds a single `setTimeout` that fires `PROACTIVE_AI_REFRESH_MARGIN_MS`
- * before the current access token expires, asks the platform mediator for
- * a fresh credential via the caller-supplied `refresh` callback, and
- * re-arms itself against the new expiry. Pure logic — does not invoke
- * `host.refresh_credential` itself; the caller threads that side-effect
- * through `refresh`.
- *
- * Pairs with the bridge-side `failTurn` deferral that suppresses
- * downstream auth-error events when a self-heal is about to run: the
- * proactive timer is the primary prevention of in-container 401s, the
- * reactive 401 path is the safety net.
- *
- * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`
- * § "Proactive refresh" (added 2026-05-20).
+ * Proactive AI-credential refresh scheduler. Holds a single timer that fires
+ * `PROACTIVE_AI_REFRESH_MARGIN_MS` before the token expires and re-arms against
+ * the new expiry via the caller-supplied `refresh`. Pure logic — the caller
+ * threads the `host.refresh_credential` side-effect. Resilience model
+ * (transient bounded-retry, terminal stop, stale-guard, non-amplification on a
+ * shared seat) is documented in `runner/CLAUDE.md` § AI Credential Mediation.
  *
  * @docLink packages/runner/dev-guide#ai-credential-mediation
  */
@@ -25,21 +15,52 @@
  * skew of a few seconds does not push the fire-time past expiry.
  */
 export declare const PROACTIVE_AI_REFRESH_MARGIN_MS: number;
+/**
+ * Stale-schedule guard window. After the bounded transient retries are
+ * exhausted the scheduler arms a single long timer this far out so a blip
+ * during a proactive fire cannot leave refresh idle indefinitely — the
+ * worst case becomes one degraded window, after which a fresh refresh is
+ * attempted. Also the threshold {@link AiCredentialRefreshScheduler.ensureArmed}
+ * uses to decide a previously-armed scheduler has gone stale.
+ */
+export declare const STALE_REARM_MS: number;
+/**
+ * Outcome of a proactive refresh attempt, returned by the caller-supplied
+ * {@link AiCredentialRefreshDeps.refresh}:
+ *
+ * - `ok` — a fresh credential was minted; `expiresAt` is its ISO expiry, or
+ *   `null` for a static token (no further refresh needed).
+ * - `transient` — a mediator/transport blip; the scheduler re-arms a bounded
+ *   retry and ultimately a stale-schedule guard.
+ * - `terminal` — the credential/account is genuinely unusable; the scheduler
+ *   stops re-arming and leaves the reactive 401 path as the safety net.
+ */
+export type AiRefreshOutcome = {
+    status: "ok";
+    expiresAt: string | null;
+} | {
+    status: "transient";
+} | {
+    status: "terminal";
+};
 /**
  * Caller-supplied side effects the scheduler invokes.
  *
- * - `refresh()` runs the actual mint round-trip; returns the new ISO
- *   expiry on success (or `null` for static tokens) and `undefined` on
- *   failure (the scheduler stays idle until the next external arming).
- * - `log()` receives operator-facing single-line strings.
+ * - `refresh()` runs the actual mint round-trip and classifies the result
+ *   into an {@link AiRefreshOutcome}.
+ * - `log()` receives operator-facing single-line strings (info level).
+ * - `logError()` receives failure strings that MUST surface at error level
+ *   (visible in `skaile session logs` and the debug panel). Defaults to
+ *   `log` when omitted.
  * - `now()` is dependency-injected for deterministic timer tests; defaults
  *   to `Date.now`.
  * - `setTimeoutImpl` / `clearTimeoutImpl` are injected for fake-timer
  *   tests; default to the host's `setTimeout` / `clearTimeout`.
  */
 export interface AiCredentialRefreshDeps {
-    refresh: () => Promise<string | null | undefined>;
+    refresh: () => Promise<AiRefreshOutcome>;
     log: (line: string) => void;
+    logError?: (line: string) => void;
     now?: () => number;
     setTimeoutImpl?: (handler: () => void, ms: number) => {
         unref?: () => void;
@@ -53,10 +74,21 @@ export interface AiCredentialRefreshScheduler {
     /**
      * Arm the timer for `expiresAtIso - marginMs`. Cancels any prior pending
      * fire. `null` / `undefined` cancels without re-arming (static PAT
-     * semantics). If the fire-time has already passed, runs `refresh()` on
-     * the next tick.
+     * semantics) and marks the credential static. If the fire-time has
+     * already passed, runs `refresh()` on the next tick. Records the
+     * credential as healthy (resets the transient-retry counter and the
+     * stale clock).
      */
     schedule(expiresAtIso: string | null | undefined): void;
+    /**
+     * Re-arm hook for the configure/wake path. Kicks a fresh refresh on the next
+     * tick when the scheduler is idle (prior terminal failure), stale (no
+     * successful fire in {@link STALE_REARM_MS}), or currently parked on the long
+     * stale-schedule guard — so a container waking during a degraded window
+     * recovers eagerly instead of waiting out the guard. No-op when a healthy
+     * refresh timer is already pending or the credential is a static PAT.
+     */
+    ensureArmed(): void;
     /** Cancel any pending fire. Idempotent. */
     cancel(): void;
     /**

package/dist/runner/src/ai-credential-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-credential-refresh.d.ts","sourceRoot":"","sources":["../../../runner/src/ai-credential-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAgB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAC7E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;IACxD,2CAA2C;IAC3C,MAAM,IAAI,IAAI,CAAC;IACf;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,uBAAuB,GAC5B,4BAA4B,CA8E9B"}
+{"version":3,"file":"ai-credential-refresh.d.ts","sourceRoot":"","sources":["../../../runner/src/ai-credential-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAgB,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAqB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAC7E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;IACxD;;;;;;;OAOG;IACH,WAAW,IAAI,IAAI,CAAC;IACpB,2CAA2C;IAC3C,MAAM,IAAI,IAAI,CAAC;IACf;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,uBAAuB,GAC5B,4BAA4B,CAgJ9B"}

package/dist/runner/src/ai-credential-retry.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared classification + bounded-retry policy for AI-credential mint failures.
+ * The single place that decides transient (`backend-error`) vs terminal
+ * (`revoked` / `not-configured` / `provider-error`), consumed by both the
+ * reactive 401 path and the proactive scheduler so they never drift. Rationale
+ * (shared-seat non-amplification) in `runner/CLAUDE.md` § AI Credential Mediation.
+ *
+ * @docLink packages/runner/dev-guide#ai-credential-mediation
+ */
+import type { CredentialMint } from "@skaile/workspaces/types";
+/** The discriminated failure codes a {@link CredentialMint} can carry. */
+export type MintFailureCode = Extract<CredentialMint, {
+    ok: false;
+}>["code"];
+/**
+ * Maximum total mint attempts (initial try + retries) on the transient path.
+ * Three attempts spanning the backoff below ride out a ~7s backend redeploy.
+ */
+export declare const MINT_RETRY_MAX_ATTEMPTS = 3;
+/**
+ * Whether a failed mint should be retried. Only `backend-error` (internal
+ * mediator outage) is transient; `not-configured`, `revoked`, and
+ * `provider-error` are terminal credential/account states where a retry
+ * cannot help.
+ */
+export declare function isTransientMintFailure(code: MintFailureCode): boolean;
+/**
+ * Backoff before the Nth retry (`retryNumber = 1` is the delay before the 2nd
+ * attempt). Exponential from a 2s base, capped at 5s, so three attempts span
+ * roughly 6s — enough to ride a backend redeploy without unbounded waiting.
+ */
+export declare function mintRetryDelayMs(retryNumber: number): number;
+/**
+ * Run `attempt` up to {@link MINT_RETRY_MAX_ATTEMPTS} times, sleeping
+ * {@link mintRetryDelayMs} between tries, stopping early on success or a
+ * terminal failure. Returns the final mint: ok, a terminal failure, or the
+ * last transient failure once the cap is reached. `sleep` is injected so tests
+ * stay deterministic.
+ */
+export declare function retryTransientMint(attempt: () => Promise<CredentialMint>, deps: {
+    sleep: (ms: number) => Promise<void>;
+    maxAttempts?: number;
+    onRetry?: (info: {
+        attempt: number;
+        nextDelayMs: number;
+        code: MintFailureCode;
+    }) => void;
+}): Promise<CredentialMint>;
+/**
+ * Truncated SHA-256 of the just-rejected access token. Sent as the OPTIONAL
+ * `rejectedFingerprint` on a retry-401 `host.refresh_credential` so the platform
+ * can coalesce concurrent rotations of the same dead token (single-flight). It
+ * is non-reversible and carries no secret material (16 hex chars = 64 bits,
+ * collision-safe for coalescing). Returns `undefined` for an empty/missing
+ * token so the field is simply omitted.
+ */
+export declare function computeRejectedFingerprint(accessToken: string | null | undefined): string | undefined;
+/** The wire input for a `host.refresh_credential` invocation (ai-credentials). */
+export interface RefreshCredentialInput {
+    kind: "ai-credentials";
+    id: string;
+    reason: "refresh" | "retry-401";
+    /** Truncated fingerprint of the just-rejected token; only on retry-401. */
+    rejectedFingerprint?: string;
+}
+/**
+ * Build the `host.refresh_credential` input. The optional
+ * `rejectedFingerprint` is attached ONLY on a `retry-401` (where a token was
+ * just rejected) and ONLY when a current token is on disk to fingerprint — on a
+ * proactive `refresh` there is no rejected token, so the field is omitted.
+ * Today's platform ignores the unknown field; the single-flight mediator uses
+ * it to coalesce concurrent rotations of the same dead token.
+ */
+export declare function buildRefreshCredentialInput(args: {
+    configId: string;
+    reason: "refresh" | "retry-401";
+    rejectedToken?: string | null;
+}): RefreshCredentialInput;
+//# sourceMappingURL=ai-credential-retry.d.ts.map

package/dist/runner/src/ai-credential-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-credential-retry.d.ts","sourceRoot":"","sources":["../../../runner/src/ai-credential-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAKzC;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAErE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,EACtC,IAAI,EAAE;IACJ,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,KAAK,IAAI,CAAC;CAC3F,GACA,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,MAAM,GAAG,SAAS,CAGpB;AAED,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,sBAAsB,CASzB"}

package/dist/runner/src/credential-rotated.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Inbound `credentialRotated` broadcast handler — the runner's receive side of
+ * the platform single-flight mediator's rotation broadcast (re-pull instead of
+ * each container force-refreshing). Dormant until the platform ships it. Wire
+ * shape + delivery-channel contract in root `MIGRATION.md`.
+ * @docLink packages/runner/dev-guide#ai-credential-mediation
+ */
+import type { CredentialMint } from "@skaile/workspaces/types";
+/** `LogSource.subkind` the platform tags its credential-rotation broadcast with. */
+export declare const AI_PROVIDER_CREDENTIAL_SUBKIND = "ai-provider-credential";
+/**
+ * Whether an inbound message is the platform's credential-rotation broadcast.
+ * Pure predicate — tolerant of unknown shapes so a malformed message is simply
+ * not matched rather than throwing on the command ingress path.
+ */
+export declare function isCredentialRotatedSignal(msg: unknown): boolean;
+/**
+ * Handle a credential-rotation broadcast: re-pull the fresh token through the
+ * supplied `repull` (a `host.refresh_credential { reason: 'refresh' }` round
+ * trip that rewrites `.credentials.json`). Idempotent and best-effort — a
+ * failed re-pull is logged at error level and the reactive 401 path remains the
+ * safety net; it never throws to the caller.
+ *
+ * The serve.ts wiring passes `mintAndPersistAiCredential` as `repull`, whose
+ * success path also re-arms the proactive refresh scheduler against the fresh
+ * expiry — so a re-pull both rewrites the file and re-schedules in one step.
+ */
+export declare function handleCredentialRotatedSignal(deps: {
+    repull: () => Promise<CredentialMint>;
+    log: (line: string) => void;
+    logError: (line: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=credential-rotated.d.ts.map

package/dist/runner/src/credential-rotated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-rotated.d.ts","sourceRoot":"","sources":["../../../runner/src/credential-rotated.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAa/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,MAAM,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB"}

package/dist/runner/src/resource-handler.d.ts

@@ -15,6 +15,12 @@ import type { AgentEvent, ConnectorRequestCommand } from "@skaile/workspaces/typ
  * @docLink packages/runner/dev-guide#flow-execution-turn-based-model
  */
 export declare function handleResourceRequest(command: ConnectorRequestCommand, manager: ConnectorManager, emit: (event: AgentEvent) => void): Promise<void>;
+/**
+ * Drop everything after the FIRST `</html>` from rclone-mounted HTML content.
+ * FIRST not last: a non-truncated VFS cache item appends an older version's tail
+ * that ends in its own `</html>`, so a last-match cut would keep the garbage.
+ */
+export declare function stripStaleHtmlTail(content: string, contentType: string): string;
 /**
  * Handle a resource request against a filesystem-face (mountable) connector.
  *

package/dist/runner/src/resource-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-handler.d.ts","sourceRoot":"","sources":["../../../runner/src/resource-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EACV,UAAU,EAEV,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAyCf;AAiCD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,IAAI,CAiGN"}
+{"version":3,"file":"resource-handler.d.ts","sourceRoot":"","sources":["../../../runner/src/resource-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EACV,UAAU,EAEV,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAOlC;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAyCf;AAcD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAI/E;AAuBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,IAAI,CAiHN"}

package/dist/runner/src/runner-capabilities.d.ts

@@ -160,6 +160,10 @@ export interface RunnerCapabilityHandlers {
     attachInstance?: (input: {
         kind: string;
         name: string;
+        preMintedToken?: {
+            token: string;
+            expiresAt?: string | null;
+        };
     }) => Promise<{
         ok: true;
         id: string;
@@ -189,6 +193,10 @@ export declare const addMcpServerInputSchema: z.ZodObject<{
 export declare const attachInstanceInputSchema: z.ZodObject<{
     kind: z.ZodString;
     name: z.ZodString;
+    preMintedToken: z.ZodOptional<z.ZodObject<{
+        token: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$strict>;
 /**
  * Build the seven `runner.*` capabilities. Caller registers each with

package/dist/runner/src/runner-capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-capabilities.d.ts","sourceRoot":"","sources":["../../../runner/src/runner-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,KAAK,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEvF;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QACrB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEvF;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QACvB,EAAE,EAAE,MAAM,CAAC;KACZ,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,OAAO,GAAG,WAAW,CAAC;QAC5B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,cAAc,CAAC;KACtB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAElE;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAE5F,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,WAAW,GAAG,OAAO,GAAG,SAAS,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAE3F;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QACrB,WAAW,EAAE,oBAAoB,CAAC;QAClC,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC1D;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;IAEF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC1D;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;CACH;AA+CD;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;kBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AAqCH;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,iBAAiB,EAAE,CAgL/F"}
+{"version":3,"file":"runner-capabilities.d.ts","sourceRoot":"","sources":["../../../runner/src/runner-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,KAAK,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEvF;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QACrB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEvF;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QACvB,EAAE,EAAE,MAAM,CAAC;KACZ,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,OAAO,GAAG,WAAW,CAAC;QAC5B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,cAAc,CAAC;KACtB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAElE;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAE5F,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,WAAW,GAAG,OAAO,GAAG,SAAS,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAE3F;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QACrB,WAAW,EAAE,oBAAoB,CAAC;QAClC,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC1D;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;IAEF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC1D;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;CACH;AA+CD;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;kBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;kBAIpC,CAAC;AAqCH;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,iBAAiB,EAAE,CAoL/F"}

package/dist/runner/src/serve-credentials.d.ts

@@ -68,4 +68,18 @@ export declare function mergeAndRewriteCredentialsFile(home: string, accessToken
  * @docLink packages/runner/dev-guide#ai-credential-mediation
  */
 export declare function extractClaudeAiOauthExpiresAt(json: string): string | null;
+/**
+ * Read the current access token from the on-disk credentials file at
+ * `<home>/.claude/.credentials.json`. Supports both the nested
+ * `claudeAiOauth.accessToken` shape the platform writes and the flat
+ * top-level `accessToken` some SDK builds use.
+ *
+ * Used by the 401-mediation path to fingerprint the just-rejected token (the
+ * one currently on disk) before asking the platform to rotate it, so the
+ * platform can coalesce concurrent rotations of the same dead token. Returns
+ * `null` when the file is absent, unreadable, or carries no token.
+ *
+ * @docLink packages/runner/dev-guide#ai-credential-mediation
+ */
+export declare function readCurrentClaudeAccessToken(home: string): string | null;
 //# sourceMappingURL=serve-credentials.d.ts.map

package/dist/runner/src/serve-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-credentials.d.ts","sourceRoot":"","sources":["../../../runner/src/serve-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqBzE"}
+{"version":3,"file":"serve-credentials.d.ts","sourceRoot":"","sources":["../../../runner/src/serve-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAaxE"}

package/dist/runner/src/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../runner/src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,OAAO,EAGL,gBAAgB,EAKjB,MAAM,+BAA+B,CAAC;AAkBvC,OAAO,KAAK,EAEV,UAAU,EAEV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AA4BlC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAE7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GACjC,IAAI,CAMN;AAkFD,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,UAAU,EAAE,eAAe,GAAG,IAAI,EAClC,UAAU,EAAE,OAAO,GAClB,wBAAwB,CAI1B;AAaD;;;;;;;;;GASG;AACH,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,GAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAoCzE;AA0CD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA06ExE"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../runner/src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,OAAO,EAGL,gBAAgB,EAKjB,MAAM,+BAA+B,CAAC;AAkBvC,OAAO,KAAK,EAEV,UAAU,EAEV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAkClC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAG7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAkB9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GACjC,IAAI,CAMN;AAkFD,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,UAAU,EAAE,eAAe,GAAG,IAAI,EAClC,UAAU,EAAE,OAAO,GAClB,wBAAwB,CAI1B;AAaD;;;;;;;;;GASG;AACH,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,GAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAoCzE;AA0CD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs8ExE"}

package/dist/runner/src/session-resource-handlers.d.ts

@@ -31,7 +31,10 @@ export declare function toPreMinted(token: {
     expiresAt?: string | null;
 }): PreMintedCredential;
 export declare function buildSessionResourceHandlers(deps: SessionResourceHandlerDeps): Pick<RunnerCapabilityHandlers, "addConnector" | "addMount" | "removeResource" | "updateCredential"> & {
-    attachConnectorInstance: (name: string) => Promise<AttachResult>;
+    attachConnectorInstance: (name: string, preMintedToken?: {
+        token: string;
+        expiresAt?: string | null;
+    }) => Promise<AttachResult>;
 };
 export {};
 //# sourceMappingURL=session-resource-handlers.d.ts.map

package/dist/runner/src/session-resource-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-resource-handlers.d.ts","sourceRoot":"","sources":["../../../runner/src/session-resource-handlers.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,WAAW,0BAA0B;IACzC,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAClD,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IAC/D,8EAA8E;IAC9E,sBAAsB,EAAE,MAAM,IAAI,CAAC;IACnC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAKD,gFAAgF;AAChF,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAkCjD,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,mBAAmB,CAEtB;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,0BAA0B,GAC/B,IAAI,CACL,wBAAwB,EACxB,cAAc,GAAG,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CACpE,GAAG;IAAE,uBAAuB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,CAqIvE"}
+{"version":3,"file":"session-resource-handlers.d.ts","sourceRoot":"","sources":["../../../runner/src/session-resource-handlers.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,WAAW,0BAA0B;IACzC,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAClD,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IAC/D,8EAA8E;IAC9E,sBAAsB,EAAE,MAAM,IAAI,CAAC;IACnC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAKD,gFAAgF;AAChF,KAAK,YAAY,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAejD,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,mBAAmB,CAEtB;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAClF,wBAAwB,EACxB,cAAc,GAAG,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CACpE,GAAG;IACF,uBAAuB,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAC1D,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5B,CAwJA"}

package/dist/sdk/asset-manager.js

@@ -1,4 +1,4 @@
-export { AssetManager, parseCanonicalLockKey } from '../chunk-KM6IWBDN.js';
+export { AssetManager, parseCanonicalLockKey } from '../chunk-B5LHVPE2.js';
 export { createScaffold, deployAll, installAgent, removeAsset } from '../chunk-4A2LAEX6.js';
 import '../chunk-FBIQ4QPF.js';
 import '../chunk-CFCSDZYF.js';

package/dist/sdk/index.js

@@ -1,6 +1,6 @@
 import { AgentClient } from '../chunk-SZ3SIVZQ.js';
-import { startAgentServer } from '../chunk-OW32SQU3.js';
-import '../chunk-GL3MUJ5L.js';
+import { startAgentServer } from '../chunk-RM2KAMGD.js';
+import '../chunk-22Q5R7SM.js';
 import '../chunk-X5YPJV4N.js';
 import '../chunk-O7SG5PC2.js';
 import '../chunk-7QBNJTTQ.js';
@@ -15,10 +15,10 @@ import '../chunk-BMQKMOQY.js';
 import '../chunk-GAH4YRCI.js';
 import '../chunk-KM6DCR7A.js';
 import '../chunk-LV2HPH3C.js';
-import '../chunk-DQLRTCA2.js';
+import '../chunk-3P7HBSSD.js';
 import '../chunk-OVRSNIKJ.js';
 import '../chunk-WLWHOA3S.js';
-import '../chunk-P7CIT445.js';
+import '../chunk-C5UK3JK7.js';
 import '../chunk-6E6PKKAD.js';
 import '../chunk-X46FY45B.js';
 import '../chunk-DEYYRFQU.js';